expose ssl_ca_file, ssl_certificate and ssl_priv_key about puppet-foreman

[ekohl]

Do you mean these Apache mod_ssl parameters? We do expose them as server_ssl_{ca,cert,key,chain,crl}. You should also override websockets_ssl_{key,cert} if you use websockets.

Katello also uses these because they don't use puppet for certificate management. It appears they use foreman-rake config to set these config values. They should use foreman_config_entry and maybe you're right that puppet-foreman should expose this. See https://github.com/Katello/puppet-certs/blob/8ed3854fffc2a4824d726352ff1bf2397c569c5c/manifests/foreman.pp#L51-L63

[kostyrev]

Do you mean these Apache mod_ssl parameters?

No. I don't care for them.

You should also override websockets_ssl_{key,cert} if you use websockets.

I do that.
For you do expose them in settings.yaml.erb

It appears they use foreman-rake config to set these config values. They should use foreman_config_entry

Yeah, but I don't use puppet either.

I've written simple Ansible role where I render foreman-answers.yaml file and let foreman-installer take care of things
but he knows nothing about ssl_ca_file, ssl_certificate and ssl_priv_key

Currently foreman-installer does not let me configure custom_config_entries either
so
for now I use ugly ansible hack for configuring the stuff I want.
And it makes me sad.

[ekohl]

Thanks for the additional description of your use case.

I wonder what @mmoll, @domcleal and @brandonweeks think about this. Should we include these values in settings.yaml or use foreman_config_entry? And should we always manage those values or expose the as separate variables?

[domcleal]

I don't think I'd mind them being always managed in settings.yaml, as it's quite common to want to override them. It may come as a surprise to anybody who's changed them already though on upgrade.

[ekohl]

If you set them in settings.yaml I don't think you can override them in the UI, though that may also surprise some users.

[domcleal]

Indeed, though I think it does show a tooltip explaining where it's set. The only problem with relying a lot on foreman_config_entry is the speed, it's relatively slow to run a rake task (though we can also improve this with Puppet provider prefetch/flush features).

[ekohl]

If the UI is clear about it, I'd prefer settings.yaml.

[domcleal]

[ekohl]

I think we should introduce separate variables which have the same defaults, agreed?

[mmoll]

I'm OK with that.

[kostyrev]

Thanks!
When will new foreman-installer be available with those params?

[domcleal]

They would be in the next major version, 1.12 (http://projects.theforeman.org/projects/foreman/wiki/Foreman_112_Schedule).

[kostyrev]

Great!
Thanks guys.
You rock!